chore(deps): Iggy SDK 0.10, RUSTSEC patches, and double-review remediation

.env.example

@@ -1,6 +1,7 @@
 # Server Configuration
+# Note: 8000 avoids colliding with the Iggy server's HTTP API on 3000
 HOST=0.0.0.0
-PORT=3000
+PORT=8000
 
 # Iggy Configuration
 # Connection string format: iggy://username:password@host:port

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ env:
     CARGO_TERM_COLOR: always
     RUST_BACKTRACE: 1
     # Minimum supported Rust version
-    MSRV: "1.90.0"
+    MSRV: "1.93.0"
 
 # Cancel in-progress runs for the same branch
 concurrency:
@@ -70,7 +70,7 @@ jobs:
                 include:
                     # MSRV check on Ubuntu only
                     - os: ubuntu-latest
-                      rust: "1.90.0"
+                      rust: "1.93.0"
         steps:
             - uses: actions/checkout@v4
             - uses: dtolnay/rust-toolchain@master
@@ -168,10 +168,10 @@ jobs:
                   token: ${{ secrets.GITHUB_TOKEN }}
 
     # ==========================================================================
-    # Dependency license check
+    # Dependency policy check (advisories + licenses, gated by deny.toml)
     # ==========================================================================
     licenses:
-        name: License Check
+        name: Dependency Policy (cargo-deny)
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
@@ -181,17 +181,16 @@ jobs:
             - name: Install cargo-deny
               uses: taiki-e/install-action@cargo-deny
 
-            - name: Check licenses
-              run: cargo deny check licenses
-              continue-on-error: true # Don't fail CI on license issues, just warn
+            - name: Check dependency policy (advisories, bans, licenses, sources)
+              run: cargo deny check
 
     # ==========================================================================
     # Final status check (for branch protection)
     # ==========================================================================
     ci-success:
         name: CI Success
         runs-on: ubuntu-latest
-        needs: [fmt, clippy, test, integration, docs, audit]
+        needs: [fmt, clippy, test, integration, docs, audit, licenses]
         if: always()
         steps:
             - name: Check all jobs passed
@@ -201,7 +200,8 @@ jobs:
                      [[ "${{ needs.test.result }}" != "success" ]] || \
                      [[ "${{ needs.integration.result }}" != "success" ]] || \
                      [[ "${{ needs.docs.result }}" != "success" ]] || \
-                     [[ "${{ needs.audit.result }}" != "success" ]]; then
+                     [[ "${{ needs.audit.result }}" != "success" ]] || \
+                     [[ "${{ needs.licenses.result }}" != "success" ]]; then
                     echo "One or more jobs failed"
                     exit 1
                   fi

.github/workflows/extended-tests.yml

@@ -75,11 +75,24 @@ jobs:
     if: ${{ github.event_name == 'schedule' || github.event.inputs.run_stress_tests == 'true' }}
     services:
       iggy:
-        image: apache/iggy:latest
+        # Keep in lockstep with docker-compose.yaml and tests/integration_tests.rs
+        image: apache/iggy:0.8.0
         ports:
           - 8090:8090
+        env:
+          # The server binds 127.0.0.1 by default - unreachable from the
+          # runner; credentials match the stress step's connection string
+          IGGY_ROOT_USERNAME: iggy
+          IGGY_ROOT_PASSWORD: iggy
+          IGGY_TCP_ADDRESS: 0.0.0.0:8090
+          IGGY_HTTP_ADDRESS: 0.0.0.0:3000
+        # --privileged: the io_uring-based server (0.6+) cannot create its
+        # runtime under the default seccomp profile ("Operation not
+        # permitted"). Healthcheck uses the bundled iggy CLI - the image
+        # ships no curl (mirrors docker-compose's healthcheck).
         options: >-
-          --health-cmd "curl -f http://localhost:3000/health || exit 1"
+          --privileged
+          --health-cmd "iggy ping"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 10

CHANGELOG.md

@@ -7,6 +7,76 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Refreshed `Cargo.lock` to patch 10 RUSTSEC advisories in transitive
+  dependencies: `bytes` (RUSTSEC-2026-0007), `time` (RUSTSEC-2026-0009),
+  `quinn-proto` (RUSTSEC-2026-0037), `rustls-webpki` (RUSTSEC-2026-0049),
+  `aws-lc-sys` (RUSTSEC-2026-0044 through 0048), and `rkyv`
+  (RUSTSEC-2026-0001)
+- `testcontainers` 0.27 bump upgrades `astral-tokio-tar` to patched 0.6.x
+  and removes unmaintained `rustls-pemfile` from the dev-dependency tree
+- `cargo audit` now reports zero vulnerabilities
+
+### Changed
+
+- Updated Apache Iggy Rust SDK from 0.8.0 to 0.10.0 (latest stable);
+  no source changes required — the `Client` trait API is unchanged
+- **Breaking**: MSRV raised 1.90 → 1.93: iggy 0.10's `compio-buf`
+  dependency uses APIs stabilized in Rust 1.93 (and declares no
+  rust-version, so cargo cannot catch this at resolution time)
+- Pinned the `apache/iggy` server image to 0.8.0 (the release paired
+  with the 0.10 SDK) in `docker-compose.yaml` and integration tests,
+  replacing the floating `latest` tag
+- Bumped direct dependencies: `tower-http` 0.7, `rand` 0.10,
+  `metrics-exporter-prometheus` 0.18, `testcontainers` 0.27 (dev),
+  `reqwest` 0.13 (dev); raised version floors for `tokio` (1.52),
+  `uuid` (1.23), and `rust_decimal` (1.42)
+- Migrated `deny.toml` to the current cargo-deny schema and pruned
+  obsolete advisory ignores; allowed `Unicode-3.0` and
+  `CDLA-Permissive-2.0` licenses required by new transitive deps
+- Documented why the service integrates at the SDK `Client` trait level
+  instead of the high-level `IggyProducer`/`IggyConsumer` clients
+- **Breaking**: default app port changed from 3000 to 8000 — the old
+  default collided with the Iggy server's HTTP API port under the
+  documented docker-compose quick start; all docs, `.env.example`, and
+  compose now agree on 8000
+- CI now fails on `cargo deny check advisories licenses` (previously
+  licenses-only and non-blocking); weekly stress tests pin
+  `apache/iggy:0.8.0` instead of `latest`
+- Updated `docker-compose.yaml` with full observability stack configuration
+- Simplified documentation section in README.md to reference `docs/`
+  directory
+
+### Fixed
+
+Findings from the session-01 eight-agent double review
+(`docs/code-reviews/`); deferred items carry tech-debt records with binding
+triggers (`docs/tech-debt/`):
+
+- **Resilience**: SDK connection errors are now classified into the
+  wrapper's connection-aware variants, making the reconnect and
+  circuit-breaker paths reachable (previously dead code); the background
+  health check performs live pings so `/health` and `/ready` stay truthful
+  during outages; reconnection no longer leaks the old client's heartbeat
+  task, resets its attempt counter per session, uses saturating backoff
+  arithmetic, and is bounded on the request path; `ensure_stream/topic` no
+  longer swallow lookup errors and tolerate losing a concurrent creation
+  race instead of crash-looping
+- **Security**: `TRUSTED_PROXIES` is enforced against the actual peer
+  address (spoofed forwarded headers from untrusted peers are ignored) and
+  invalid entries fail startup; the auth brute-force limiter meters
+  failures only, so valid-key clients are no longer throttled to the
+  failure budget
+- **Observability**: the Prometheus exporter is now actually started on
+  `METRICS_PORT` and the message/reconnect/breaker metrics are recorded;
+  Prometheus scrapes the correct port
+- **API**: `count=0` polls return 400 instead of 500; all-digit resource
+  names ("42") are treated as names, not numeric server IDs; removed the
+  dead `PollMessagesRequest` type
+- Added `issues: write` permission to CI security audit job to allow
+  creating advisory issues
+
 ### Added
 
 - **Observability Stack**: Complete Grafana-based monitoring setup
@@ -20,21 +90,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Durable storage guide (`docs/durable-storage-guide.md`): storage architecture, fsync configuration, S3 backup/archiving, recovery procedures
   - Documentation index (`docs/README.md`) with topic-based navigation
 
-### Changed
-
-- Updated `docker-compose.yaml` with full observability stack configuration
-- Simplified documentation section in README.md to reference `docs/` directory
-
-### Fixed
-
-- Added `issues: write` permission to CI security audit job to allow creating advisory issues
-
-### Security
-
-- Ignored unmaintained transitive dependency advisories in `deny.toml`:
-  - `RUSTSEC-2024-0384` (instant): from iggy -> reqwest-retry -> parking_lot v0.11
-  - `RUSTSEC-2025-0134` (rustls-pemfile): from testcontainers -> bollard (dev-dep only)
-
 ## [0.1.0] - 2024-12-01
 
 ### Added